Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A Use-After-Free (UAF) vulnerability exists in the Cast streaming component’s PlaybackCommandDispatcher due to an uncanceled delayed task. A callback bound with base::Unretained(this) can be posted with a delay and outlive its parent object. On platforms where BackupRefPtr is disabled at runtime, this can potentially be exploited for Remote Code Execution in the browser process.

Affected files:

• components/cast_streaming/browser/control/playback_command_dispatcher.cc
• components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc
• components/cast_streaming/browser/control/playback_command_dispatcher.h
• components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.h
• third_party/openscreen/src/cast/streaming/public/protobuf_messenger.h

Estimated timestamp from git blame: 2022-05-12

Vulnerability Summary

A Use-After-Free (UAF) vulnerability exists in PlaybackCommandDispatcher within the Cast streaming component (components/cast_streaming/browser/control/playback_command_dispatcher.cc). The class binds a callback using base::Unretained(this) and passes it to an RpcDemuxerStreamHandler, which can schedule it as a delayed task. If the Cast session is terminated before the task executes, the dispatcher is destroyed without canceling the task, leading to a UAF.

Technical Details

In PlaybackCommandDispatcher::OnRemotingSessionNegotiated(), a callback to SendRemotingRpcMessageToRemote is created using base::Unretained(this):

demuxer_stream_handler_ = std::make_unique<remoting::RpcDemuxerStreamHandler>(
    task_runner_, this,
    // ...
    base::BindRepeating(&PlaybackCommandDispatcher::SendRemotingRpcMessageToRemote,
                        base::Unretained(this)));

This callback is ultimately passed to MessageProcessor. If an invalid config is received on an RPC_DS_READUNTIL_CALLBACK message, MessageProcessor::OnRpcReadUntilCallback() invokes OnNoBuffersAvailable() to request a corrected configuration. To rate-limit these requests, OnNoBuffersAvailable() calculates a delay (remaining_time, up to 100ms) and posts the callback to the SequencedTaskRunner:

task_runner_->PostDelayedTask(
    FROM_HERE,
    base::BindOnce(process_message_cb_, remote_handle(), std::move(message)),
    remaining_time);

If the remote sender immediately closes the Cast control channel, the session teardown sequence is initiated. ReceiverSessionImpl::OnMojoDisconnect() calls CastStreamingSession::Stop(), which destroys the ReceiverSessionClient and, consequently, the PlaybackCommandDispatcher. The pending delayed task, however, is not canceled.

When the timer expires, the task executes SendRemotingRpcMessageToRemote() using a dangling this pointer. It checks if (!messenger_) and invokes messenger_->SendMessageToRemote(*message). Because messenger_ is a raw pointer and ProtobufMessenger::SendMessageToRemote utilizes an internal std::function callback, controlling the freed memory allows an attacker to hijack the instruction pointer when the std::function is executed.

Notably, on CastOS (Linux-based Chromecast), BackupRefPtr (MiraclePtr) is compiled in but explicitly disabled at runtime by default (enable_backup_ref_ptr_feature_flag = false). Consequently, base::Unretained acts like a standard raw pointer and does not quarantine the allocation, rendering the UAF fully exploitable.

Potential Reproduction Steps

Note: These are suggested theoretical steps; our tooling agent does not have the ability to run code or provide a functional PoC.

1. An attacker on the local network initiates a Cast streaming session with a CastOS receiver device, triggering the creation of a PlaybackCommandDispatcher.
2. The attacker negotiates a remoting session and acquires demuxer handles via an RPC_ACQUIRE_DEMUXER network message.
3. The attacker sends a valid network message to trigger an initial buffer request.
4. Rapidly (within 100ms), the attacker sends an RPC_DS_READUNTIL_CALLBACK message with an invalid configuration (e.g., an audio config for a video handle). This causes OnNoBuffersAvailable() to post a delayed task referencing the base::Unretained callback.
5. The attacker immediately terminates the Cast control channel (e.g., via a TCP FIN packet), causing the browser process to destroy the PlaybackCommandDispatcher.
6. The attacker quickly sprays the browser process heap (e.g., by rapidly opening new Cast connections and sending controlled payload data) to reclaim the memory previously occupied by the dispatcher. They set the offset corresponding to messenger_ to point to a fake, attacker-controlled ProtobufMessenger object.
7. After the ~100ms delay timer expires, the queued task executes. It dereferences the attacker-controlled messenger_ pointer and calls SendMessageToRemote(), which executes a hijacked std::function, leading to Remote Code Execution in the unsandboxed browser process.

Suggested Fix

Update PlaybackCommandDispatcher to use a base::WeakPtr to bind its callbacks instead of base::Unretained(this).

Add a base::WeakPtrFactory<PlaybackCommandDispatcher> weak_factory_{this}; as the last member of the class, and bind the callback using:

base::BindRepeating(
    &PlaybackCommandDispatcher::SendRemotingRpcMessageToRemote,
    weak_factory_.GetWeakPtr())

This ensures that if the PlaybackCommandDispatcher is destroyed before the delayed task executes, the weak pointer will be invalidated, and the callback will safely become a no-op instead of operating on freed memory.

Evaluated with Chrome root at commit: f200f57a19490707ff8bc7aa5de3cbc443a3afad

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.